Parameters passed to token_replace() are not checked

/**
 * Helper function for preg_replace_callback to generate the html for each token filter
 */
function token_filter_replacetoken($matches) {  
  global $user;
  $type  = $matches[1];
  $token = $matches[2];
  switch ($type) {
    case 'user' :
      $object = $user;
      break;
    case 'global':
    default:
      $object = NULL;
      break;
  } 
  
  // add [ ] to the token so str_replace correctly replaces token values
  // if not, a token like 'custom_text' won't be properly replaced if another token like 'custom' exists  
  $token = '['.$token.']';
    
  $output = token_replace($token, $type, $object, '[', ']');  
  return $output;
}

The function passes any value for $type, even if it's not global, or user.

The correct code should be

/**
 * Helper function for preg_replace_callback to generate the html for each token filter
 */
function token_filter_replacetoken($matches) {  
  global $user;
  
  $type  = $matches[1];
  $token = $matches[2];
  
  if ($type != 'user' && $type != 'global') {
    return '';
  }
  
  switch ($type) {
    case 'user':
      $object = $user;
      break;
    
    case 'global':
    default:
      $object = NULL;
      break;
  } 
  
  // add [ ] to the token so str_replace correctly replaces token values
  // if not, a token like 'custom_text' won't be properly replaced if another token like 'custom' exists  
  $token = '['.$token.']';
    
  $output = token_replace($token, $type, $object, '[', ']');  
  return $output;
}

Also, $token = '['.$token.']' forces the user to use [token user [uid]], when it would be preferable to use [token user [uid]].